Functional Safety Manual Vortex flow measuring system with 4 20 ma output signal Application Monitoring of maximum and/or minimum flow in systems which are required to comply with particular safety system requirements as per IEC/EN 61508 and IEC/EN 61511-1. The measuring device fulfils the requirements concerning: Functional safety in accordance with IEC/EN 61508 and IEC/EN 61511-1 Explosion protection (depending on the version) Electromagnetic compatibility as per EN 61326-3-2 and NAMUR recommendation NE 21 Your benefits For flow monitoring (Min., Max., range) up to SIL 2 for Prowirl 72 independently assessed (Functional Assessment) by exida.com as per IEC/EN 61508 and IEC/EN 61511-1 For flow monitoring (Min., Max., range) up to SIL 1 for Prowirl 73 independently assessed (Functional Assessment) by exida.com as per IEC/EN 61508 and IEC/EN 61511-1 Continuous measurement Measurement is virtually independent of product properties Permanent self-monitoring Easy installation and commissioning SD00100D/06/EN/13.11 71141458 Valid as of version V 01.00.zz (device software)
Table of contents SIL Declaration of Conformity................... 3 Prowirl 72.......................................... 3 Prowirl 73.......................................... 4 Introduction................................. 5 Depiction of a safety system (protection function)............. 5 Layout of measuring system with Prowirl 72, 73..... 6 System components................................... 6 Safety function data................................... 6 Supplementary device documentation...................... 7 Configuration and installation instructions......... 7 Installation instructions................................. 7 Configuration instructions.............................. 7 Monitoring options.................................... 7 Security locking...................................... 8 Setting instructions for evaluation unit..................... 8 Response to errors.................................... 9 Information on the useful lifetime of electric components....... 9 Proof test.................................. 10 Proof testing the measuring system....................... 10 Exida management summary................... 12 Prowirl 72......................................... 12 Prowirl 73......................................... 14 Appendix (safety-related characteristic values)..... 16 Introductory comments............................... 16 Prowirl 72......................................... 17 Prowirl 73......................................... 18 2 Endress+Hauser
SIL Declaration of Conformity Prowirl 72 Prowirl72-en-konformitaet.pdf Endress+Hauser 3
Prowirl 73 Prowirl73-en-konformitaet.pdf 4 Endress+Hauser
Introduction Depiction of a safety system (protection function) The following tables define the achievable Safety Integrity Level (SIL) or the requirements regarding the "Average Probability of Failure on Demand" (PFD AVG ), the "Hardware Fault Tolerance" (HFT) and the "Safe Failure Fraction" (SFF) of the safety system. The specific values for the Prowirl measuring system can be found in the tables in the Appendix. In general, the following permitted failure probability of the complete safety function applies, depending on the SIL for systems which must react on demand - e.g. a defined max. flow exceeded - (Source: IEC 61508, Part 1): SIL PFD AVG 4 10 5 to < 10 4 3 10 4 to < 10 3 2 10 3 to < 10 2 1 10 2 to < 10 1 The following table shows the achievable SIL as a function of the safe failure fraction and the hardware fault tolerance of the complete safety system for type B systems (complex components, for definition see IEC 61508, Part 2): SFF HFT 0 1 (0) 1) 2 (1) 1) < 60% Not permitted SIL 1 SIL 2 60 % to < 90 % SIL 1 SIL 2 SIL 3 90 % to < 99 % SIL 2 SIL 3 99 % SIL 3 Note 1) In accordance with IEC 61511-1 (section 11.4.4), the HFT can be reduced by one (values in brackets) if the devices used meet the following conditions: - The device is proven in use - Only process-relevant parameters can be changed at the device (e.g. measuring range, ) - Changing the process-relevant parameters is protected (e.g. password, jumper, ) - The function has a SIL requirement of less than 4 The Prowirl 72 measuring system meets these conditions, the Prowirl 73 measuring system is not proven in use. General information on functional safety (SIL) is available at: www.de.endress.com/sil and in Competence Brochure CP002Z "Functional Safety in the Process Industry - Risk Reduction with Safety Instrumented Systems" (available in the download section of the Endress+Hauser website: www.endress.com Download Document code: CP002Z). Endress+Hauser 5
Layout of measuring system with Prowirl 72, 73 System components 4 1 2 3 System components 1 Pump 2 Measuring device 3 Valve 4 Automation system A0015443 Note An analog signal (4 20 ma) proportional to the flow rate is generated in the transmitter. This is sent to a downstream automation system where it is monitored to determine whether it falls below or exceeds a specified limit value. The automation system is also capable of reading in additional process variables, such as pressure or temperature, in order to calculate a mass flow or corrected volume flow using this information and the volume flow measured by Prowirl 72, 73. To ensure an intrinsically safe power supply to the Prowirl 72, 73, an active barrier (e.g. RN221N) can also be switched between the automation system and the Prowirl 72, 73: Sensor Active barrier (e.g. RN 221N) Automation system (e.g. PLC) Actuator (e.g. valve) PFD 35 % PFD 10 % Safety function data Note Note Share of active barrier in the average Probability of Failure on Demand" (PFD avg ). The safety-related signal is the 4 to 20 ma analog output signal of the measuring device. All safety functions refer exclusively to current output 1. The measuring device must be protected against unauthorized access see "Locking" section ( ä 8). The application program in the safety automation system is designed in such a way that "fail high" and "fail low" failures are detected by the safety function regardless of the effect (safe or dangerous). If communication also takes place via the HART protocol in the Prowirl 72/73 measuring device, HART write protection must be activated see the "Locking" section ( ä 8). The characteristic values determined (see appendix) apply only to the current output (4 to 20 ma) of the following versions: Prowirl 72/73***-***********A Prowirl 72/73***-***********W The mandatory settings and safety function data emanate from the section "Settings and installation instructions" ( ä 7) and the appendix ( ä 16). The measuring system's response time is 2 s. The monitoring function's alarm delay does not start until after this. 8 hours is set for the time between when the failure occurs and the failure is eliminated (MTTR). 6 Endress+Hauser
Supplementary device documentation The following documentation must be available for the measuring system: Device type Operating Instructions incl. Description of Device Functions Prowirl 72 BA00084D/06 Prowirl 73 BA00094D/06 This document also includes information on application limits and ambient conditions as well as the functional specifications of the current output. Furthermore, for devices with explosion protection approvals the relevant safety instructions in the accompanying Ex documentation (XA) must be followed. Configuration and installation instructions Installation instructions Note Configuration instructions Instructions for the correct installation of the measuring device can be found in the Operating Instructions (BA) supplied see "Supplementary device documentation" ( ä 7). Suitability of the measuring device Carefully select the nominal diameter of the measuring device in accordance with the application's expected flow rates. The maximum flow rate during operation must not exceed the specified maximum value for the sensor. In safety-related applications, it is also recommended to select a limit value for monitoring the minimum flow rate that is not smaller than 5 % of the specified maximum value of the sensor. The measuring device must be used correctly for the specific application, taking into account the medium properties and ambient conditions. Carefully follow instructions pertaining to critical process situations and installation conditions from the device documentation. Please contact your Endress+Hauser sales office for further information. The measuring device can be configured in various ways in process control protection systems: Via onsite operation (LCD display) Via HART handheld terminal DXR 375 Via PC (remote operation) using service and configuration software (e.g. "FieldCare") The tools mentioned can also be used to retrieve information on the software and hardware revision of the device. Further instructions on the settings can be found in the corresponding Operating Instructions see "Supplementary device documentation" ( ä 7). Monitoring options Note The measuring device can be used in protective systems to monitor (Min., Max. and range) the following: Volume flow The device must be correctly installed to guarantee safe operation. A B C 4 Min. [ma] Max. 20 Monitoring options in protective systems A B C Min. alarm Max. alarm Range monitoring = Safety function activated = Permitted operating status A0015277 Endress+Hauser 7
The following table shows the settings which are necessary to use the measuring device in a safety-related application. The settings refer to the 4 to 20 ma output value of the current output which corresponds to the flow value. Group Name of function in the group Allowed setting when Promass is used for a safety function CURRENT OUTPUT ASSIGN CURRENT OUTPUT (only Prowirl 73) Volume flow CURRENT OUTPUT CURRENT SPAN 4 20 ma HART NAMUR 0-20 ma HART US All configuration options 4 to 20 ma with HART communication are only permitted if HART write protection is activated ( ä 8, "Locking" section) CURRENT OUTPUT FAILSAFE MODE Min. current value Max. current value CURRENT OUTPUT SIMULATION CURRENT Off SYSTEM PARAMETER POSITIVE ZERO RETURN Off SUPERVISION ASSIGN SYSTEM ERROR Off (the assignment of notice and error messages may not be changed) SUPERVISION ALARM DELAY 0 20 s SIMULATION SYSTEM SIMULATION FAILSAFE MODE Off SIMULATION SYSTEM SIMULATION MEASURAND Off A detailed description of the functions of the device can be found in the appropriate "Description of Device Functions" see "Supplementary device documentation" ( ä 7). Security locking The software must be locked in order to protect the process-related parameters from being changed. This is done using a code which may be selected by the user. Software locking for local operation Function DEFINE PRIVATE CODE Selectable code number (except 0) When using HART communication, the HART write protection must be activated. This can be done with the aid of a jumper on the I/O board. Please refer to the appropriate Operating Instructions for the correct procedure to activate the HART write protection see "Supplementary device documentation" ( ä 7). Setting instructions for evaluation unit The calculated limit value (ma value corresponding to the desired maximum and/or minimum flow rate) must be entered at the following limit contactor (automation system). For all adjustment and setting procedures, please refer to the relevant Operating Instructions see "Supplementary device documentation" ( ä 7). 8 Endress+Hauser
Response to errors Note The response in operation and failures is described in the Operating Instructions of the device see "Supplementary device documentation" ( ä 7). Repair: The repair of the devices must principally be performed by Endress+Hauser. Is the repair carried out by other people, the safety related functions can no longer be assured. Exception: The replacement of modular components by original spare parts is permitted by qualified personnel of the customer, if trained by Endress+Hauser for this purpose. A failure of a SIL marked Endress+Hauser product, which was operated in a safety instrumented system, shall be reported to sil@endress.com including product type, serial number and description of the failure. Device failures must be reported to the manufacturer. The user provides a detailed statement to the manufacturer describing the failure and any possible effects. There is also information flow as to whether this is a dangerous failure or a failure which cannot be detected directly. In the event of failure of a SIL-labeled Endress+Hauser device, which has been operated in a safety function, the "Declaration of Contamination and Cleaning" with the corresponding note "Used as SIL device in protection system" must be enclosed when the defective device is returned. Information on the useful lifetime of electric components Note The established failure rates of electrical components apply within the useful lifetime as per IEC/EN 61508-2, section 7.4.7.4, note 3. The manufacturer and plant owner/operator must take appropriate measures to achieve a longer service life as per DIN EN 61508-2, note NA4. Endress+Hauser 9
Proof test Proof testing the measuring system Note Check the operativeness of safety functions at appropriate intervals. The operator must determine the checking interval and take this into account when determining the probability of failure PFD avg of the sensor system. In a single-channel architecture, the PFD avg value to be used depends on the diagnostic coverage of the proof test (PTC = Proof Test Coverage) and the intended lifetime (LT = Lifetime) in accordance with the following formula: PFD avg [PTC/2 T ( 1 PTC)/2 LT ] du.. +. i A0015275 The functional test must be carried out in such a way that it verifies correct operation of the safety device in conjunction with all of the other components. Each test must be fully documented. The accuracy of the measured value must first be checked in order to test the safety function (Min., Max., range). This involves approaching the configured limit values upon which the safety function (including actuator) should be activated. Checking the accuracy of the measured values is sufficient in order to test the "Range" safety function. During the proof test, alternative monitoring measures must be taken to ensure process safety. A proof test of the device can be performed in the following steps: 1. Checking the digital measured value One of the following tests must be carried out depending on the measured variable to be monitored and the available equipment: a. Test sequence A Checking the digital measured value with a calibration rig Volume flow The measuring device is recalibrated using a calibration rig that is certified in accordance with ISO 17025. This can be done on an installed device using a mobile calibration rig or using factory calibration if the device has been disassembled. The amount of deviation between the measured flow rate and the set point must not exceed the maximum measured error specified in the Operating Instructions. Note Please contact your Endress+Hauser sales office for further information on standard methods for on-site calibration of flowmeters. b. Test sequence B Checking the digital measured value using the installed totalizer Volume flow A calibrated measuring vessel is filled with the medium at a flow rate which approximately corresponds to the limit value to be monitored. The change in the volume in the measuring vessel is read off before and after filling and compared with the totalizer installed in the measuring device. The amount of deviation must not exceed the maximum measured error specified in the Operating Instructions. For range monitoring, this test must be carried out separately for the upper and lower limit value. c. Test sequence C Checking the digital measured value using Fieldcheck Volume flow Verification of the measuring device in an installed state with Fieldcheck as described in Operating Instructions BA00067D/06. Fieldcheck displays the test results (passed/failed) automatically. This test can be carried out without removal of the flowmeter and makes periodic inspection easier. The high diagnostic coverage means that > 90 % of undetected failures are detected whereby the level of increase in the average probability of failure PFD AVG is lower than without the check ( graphic below). The average probability of failure PFD AVG can be estimated using the formula for this ( ä 10) and taking into account the intended lifetime t. When used in conjunction with the "FieldCare" software package, test results can be imported into a database, printed and used as verification for the relevant certification body. 10 Endress+Hauser
PFD SIL 1 SIL 2 without check PFD avg SIL 3 with periodic check Checking interval Ti Single-channel system architecture 1oo1 Operating time LT A0015615-EN 2. Checking the temperature measurement (only Prowirl 73) The medium temperature is required by the device for compensation of measured values and for diagnostic purposes. The medium temperature determined digitally by the device is compared with the measured value of a calibrated thermometer. The amount of deviation must not exceed 2 C (4 F). 3. Checking the 4 20 ma current output Using the current simulation (fixed current value) option available in the operating menu, set the current output of the device to the values 3.6 ma, 4.0 ma, 20.0 ma and 22.0 ma one after another and compare with the measured values of a calibrated, external current measuring device. Note 4. Checking the safety function Correct activation of the safety function - including actuator - must be checked by outputting suitable current values on the 4 20 ma interface per current simulation (just below and above the switch point). For range monitoring, this test must be carried out separately for the upper and lower limit value. 5. Completing the proof test Switch the 4 20 ma current output to measured value output (if necessary). The proof test is only completed when steps 1 to 5 are accomplished. 98 % of dangerous, undetected failures are detected using test sequences 1a to 1b, whereas 90 % of dangerous, undetected failures are detected using test sequence 1c. If one of the test criteria from the test sequences described above is not fulfilled, the device may no longer be used as part of a protective system. The influence of systematic faults on the safety function are not covered by the test and must be examined separately. Systematic faults can be caused, for example, by medium properties, operating conditions, build-up or corrosion. Endress+Hauser 11
Exida management summary Prowirl 72 72_1.pdf 12 Endress+Hauser
72_2.pdf Endress+Hauser 13
Prowirl 73 73_1.pdf 14 Endress+Hauser
73_2.pdf Endress+Hauser 15
Appendix (safety-related characteristic values) Introductory comments Note Depending on the order code, Prowirl flow measuring systems are supplied with different signal inputs and outputs. For the purposes of clarity, similar types of electronics modules are grouped into categories. The safety-related characteristic values are described separately for each of these categories see sections "Category 1-n". The tables provided in these category sections contain all the important characteristic values. The values apply to all possible applications: The failure rates indicated refer to the failure rates of Siemens Standard SN29500 at an ambient temperature of +40 C (+104 F). Comments on the term "dangerous undetected failures" Situations in which the process does not respond to a demand (i.e. the measuring device does not demonstrate the predefined failsafe mode) or in which the output signal deviates more than the total measured error as specified. Please refer to the "Performance characteristics" section of the Operating Instructions for more detailed information on the total measured error. The following presumptions are made: The failure rates are constant, wear out mechanisms are not included. Failure propagation is not relevant. The HART protocol is only used to read out data during normal operation. The recovery time after a safe failure is 8 hours. The test time of the automation system to react to a detected failure is one hour. All modules are operated in the "low demand mode". Only current output 1 is used for safety-related applications. Failure rates of the external power supply are not included. The stress levels are average values for an industrial environment and are comparable with the Ground Fixed classification of MIL-HDBK-217F. Alternatively, the assumed environment is similar to IEC 60654-1, Class C (sheltered location) with temperature limits within the manufacturer's rating and an average transmitter temperature of 40 C (104 F) over a longer time period. The humidity level is assumed to be within the manufacturer's rating. Only the versions described are used for safety applications. As the optional display does not constitute a part of the safety function, the failure rate of the display is not taken into account in the calculations. The application program in the safety automation system is designed in such a way that "fail high" and "fail low" failures are detected by the safety function regardless of the effect (safe or dangerous). 16 Endress+Hauser
Prowirl 72 Specific values Prowirl 72 SIL SIL 2 HFT 0 SFF > 76.6 % PFD avg (based on a service interval of 4 years) < 3.06 10 3 Complete functional test e.g. by approaching the flow limit values Product life span every 4 years (for additional values see the following diagram) 10 years Detailed data on error rates: Sensor Prowirl 72 safe dd du SFF 0 FIT 138 FIT 4 FIT 97.2 % Version Error category sd [FIT] Non-Ex + Ex-i/IS; compact Non-Ex + Ex-i/IS; remote Ex-d/XP compact Ex-d/XP remote Electronics Prowirl 72 su [FIT] dd [FIT] du [FIT] SFF DC S DC D low = sd high = dd 11 168 350 161 76.6 % 6.1 % 68.4 % low = dd high = sd 350 168 11 161 76.6 % 67.5 % 6.4 % low = sd high = dd 11 203 446 171 79.4 % 5.1 % 72.2 % low = dd high = sd 446 203 11 171 79.4 % 68.7 % 6.0 % low = sd high = dd 17 228 345 161 78.5 % 6.9 % 68.1 % low = dd high = sd 345 228 17 161 78.5 % 60.2 % 9.5 % low = sd high = dd 17 264 441 171 80.8 % 6.0 % 39.3 % low = dd high = sd 441 264 17 171 80.8 % 29.6 % 9.0 % Endress+Hauser 17
Prowirl 73 Specific values Prowirl 73 SIL SIL 1 HFT 0 SFF > 76.8 % PFD avg (based on a service interval of 4 years) < 7.90 10 3 Complete functional test e.g. by approaching the flow limit values Product life span every 10 years (for additional values see the following diagram) 10 years Detailed data on error rates: Sensor Prowirl 73 safe dd du SFF 16 FIT 138 FIT 4 FIT 97.5 % Version Error category sd [FIT] Non-Ex + Ex-i/IS; compact Non-Ex + Ex-i/IS; remote Ex-d/XP compact Ex-d/XP remote Electronics Prowirl 73 su [FIT] dd [FIT] du [FIT] SFF DC S DC D low = sd high = dd 11 181 366 167 76.8 % 5.7 % 68.6 % low = dd high = sd 366 181 11 167 76.8 % 66.9 % 6.1 % low = sd high = dd 11 216 462 177 79.5 % 4.8 % 72.3 % low = dd high = sd 462 216 11 177 79.5 % 68.1 % 5.8 % low = sd high = dd 17 241 361 167 78.7 % 6.5 % 68.3 % low = dd high = sd 361 241 17 167 78.7 % 59.9 % 9.2 % low = sd high = dd 17 277 457 177 80.9 % 5.7 % 72.0 % low = dd high = sd 457 277 17 177 80.9 % 62.2 % 8.7 % 18 Endress+Hauser
Endress+Hauser 19
Instruments International Endress+Hauser Instruments International AG Kaegenstrasse 2 4153 Reinach Switzerland Tel.+41 61 715 81 00 Fax+41 61 715 25 00 www.endress.com info@ii.endress.com SD00100D/06/EN/13.11 71141458 FM+SGML 9.0 ProMoDo